» wwe_1.43.5.6.exe
Overview
Analysis
File Details

wwe_1.43.5.6.exe

installation-sur-iphone.com

The application wwe_1.43.5.6.exe by installation-sur-iphone.com has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars.

File name:

wwe_1.43.5.6.exe

Publisher:

installation-sur-iphone.com (signed and verified)

MD5:

02876eaa44a0291d181ae59039dc5c4d

SHA-1:

8f558209ad7ff82261efebc5393a3a3ad690a0cd

SHA-256:

7ae325697e4f9da7dd7dcb1ce7fa06b14d500da7cd9492a3f730e202d66a0986

Scanner detections:

4 / 68

Status:

Potentially unwanted

Explanation:

Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:

11/27/2024 3:36:09 PM UTC (today)

Scan engine

Detection

Engine version

avast!

Win32:Malware-gen

160215-2

Dr.Web

Adware.Searcher.2853

9.0.1.05190

Reason Heuristics

PUP.OpenCandy.Bundler (L)

16.2.20.18

VIPRE Antivirus

Threat.4150696

47240

File size:

3.3 MB (3,499,640 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\appdata\roaming\opencandy\58b10d42551249728ae0e114da8b42f3\wwe_1.43.5.6.exe

Digital Signature

Signed by:

installation-sur-iphone.com

Authority:

thawte, Inc.

Valid from:

3/24/2015 7:00:00 AM

Valid to:

3/24/2016 6:59:59 AM

Subject:

CN=installation-sur-iphone.com, O=installation-sur-iphone.com, L=Montreal, S=Quebec, C=CA

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

4B3B4C34A65749DBB9235BE933415AEC

File PE Metadata

Compilation timestamp:

12/6/2009 5:53:18 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

98304:DDFg9CiKc3cOS/pkXQcQrRc9192Q+ZkFaYSgON7soze:DDiwAQ/pkhsW7FaYoJtze

Entry address:

0x36A0

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 88, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, B8, 63, 42, 00, E8, EE, 2E, 00, 00, A3, 04, 63, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, B0, 0C, 42, 00, FF, 15, 58, 81, 40, 00, 68, 10, A8, 40, 00, 68, 00, 5B, 42, 00, E8, F4, 29, 00, 00, FF, 15, B0, 80, 40, 00, BF, 00, C0, 42, 00, 50, 57, E8, E2, 29, 00, 00... 
[+]

Entropy:

7.9963

Packer / compiler:

Nullsoft install system v2.x

Code size:

24.5 KB (25,088 bytes)

Remove wwe_1.43.5.6.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.